Date:
Tuesday, Nov 10th, 2026
Advisory ID:
BACKDROP-SA-CORE-2026-022
Security risk:
Moderately Critical
Vulnerability:
Information Disclosure
CVE ID:
Versions affected:
MimeMail module, all versions prior to 1.x-1.1.10
Description:
The Mime Mail module gives Backdrop sites the ability to send HTML email messages.
Under rare site configuration conditions, a person with the ability to send HTML emails could send non-public data that had been uploaded to the files directory.
This vulnerability is mitigated by the fact the attacker would need advance knowledge of uploaded files, and also have permission to send HTML emails and set the recipient list.
Solution:
Update your site to use the most recent version of MimeMail module. Download available on the MimeMail project page.
Reported By:
Coordinated By:
- Jen Lampton of the Backdrop CMS Security Team
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team